Chrome Enterprise

Chrome Enterprise Premium is a paid tier of Google's Chrome Enterprise that adds access control, data protection, and threat protection to the managed Chrome browser. It decides whether a user can reach an application based on the user's identity, device, and context. It also scans and controls data movement in the browser and blocks malware and phishing. Google states that the controls are built into Chrome and need no separate client software, and that they work on unmanaged and personal (bring-your-own) devices.

Audience

Security and IT administrators who manage Chrome across a workforce, including organizations with contractors and personal devices. It also suits teams replacing VPN access to internal web applications.

Product Lineage

Chrome Enterprise Premium was sold as BeyondCorp Enterprise. It extends Chrome Enterprise Core, the no-cost management tier. Google's documentation for the older name now redirects to the Chrome Enterprise Premium overview.

Key Capabilities

• Context-Aware Access: Grants or denies access to SaaS apps, Google Cloud apps, and private web apps based on access levels. Administrators define access levels in Access Context Manager with Common Expression Language (CEL) conditions on user, device, and Chrome management state. The Endpoint Verification extension supplies device state.
• Chrome Enterprise Premium secure gateway: A forward proxy that gives users access to private web applications in Google Cloud, other clouds, and on-premises networks without a VPN. Users authenticate through the force-installed Secure Enterprise Browser extension.
• Data loss prevention (DLP): Rules with predefined or custom detectors apply to copy and paste, uploads, downloads, printing, and screenshots. The vendor also lists dynamic watermarking and optical character recognition to scan uploaded images. The Chrome Content Analysis Connector and an open-source content analysis SDK let third-party DLP agents inspect content. A file transfer connector scans files moved between file systems on ChromeOS.
• Threat protection: Real-time Safe Browsing for malware and phishing, advanced sandboxing and deep scanning of files, password and credential protection, and URL filtering by category. A generative AI URL category covers sites that create content with AI.
• Security insights and reporting: Reporting on risky users, sensitive data transfers, shadow AI activity, and other security events, with the ability to act on them. An evidence locker retains evidence of events.
• Connectors: An open connector framework sends telemetry to identity providers, endpoint protection products, and SIEM and XDR tools.

Technical Specifications

• Device signals: Partner signals come from Check Point, CrowdStrike, Lookout, and VMware. Google states that it is not responsible for the accuracy of data supplied by partners.
• Identity providers: Google Workspace, Google Cloud Identity, Microsoft Entra ID (listed as Azure Active Directory), Okta, and Ping Identity.
• Secure gateway requirements: A Chrome Enterprise Premium license and a Google Cloud project with billing and the BeyondCorp API enabled. Proxy authentication uses basic HTTP authentication, so the Chrome AuthSchemes policy must include basic, and BasicAuthOverHttpEnabled must be disabled. Applications outside Google Cloud connect through Cloud VPN or Cloud Interconnect.
• Management: Chrome is managed through the cloud-based console in the Google Admin console.

Pricing and Licensing

The vendor lists Chrome Enterprise Premium at $6 per user per month. Chrome Enterprise Core is free. A 60-day trial of Premium is available.